From e9ef943a5fd38cdf1daca94ae71b325f2543a070 Mon Sep 17 00:00:00 2001
From: David Malcolm <dmalcolm@redhat.com>
Date: Wed, 29 Jul 2020 18:52:27 -0400
Subject: [PATCH 350/377] FIXME: update more expected results

---
 gcc/testsuite/gcc.dg/analyzer/explode-2.c     | 10 +--
 .../analyzer/malloc-ipa-8-double-free.c       | 82 ++++++++++++-------
 .../gcc.dg/analyzer/malloc-ipa-8-unchecked.c  |  6 +-
 .../gcc.dg/analyzer/malloc-paths-9.c          | 59 +------------
 4 files changed, 61 insertions(+), 96 deletions(-)

diff --git a/gcc/testsuite/gcc.dg/analyzer/explode-2.c b/gcc/testsuite/gcc.dg/analyzer/explode-2.c
index 31821168097..cca5fbd4da6 100644
--- a/gcc/testsuite/gcc.dg/analyzer/explode-2.c
+++ b/gcc/testsuite/gcc.dg/analyzer/explode-2.c
@@ -8,7 +8,7 @@
 
 #include <stdlib.h>
 
-#if 0
+#if 1
 extern int get (void);
 
 void test (void)
@@ -20,28 +20,28 @@ void test (void)
 	{
 	default:
 	case 0:
-	  p0 = malloc (16);
+	  p0 = malloc (16); /* { dg-warning "leak" } */
 	  break;
 	case 1:
 	  free (p0); /* { dg-warning "double-'free' of 'p0'" } */
 	  break;
 
 	case 2:
-	  p1 = malloc (16);
+	  p1 = malloc (16); /* { dg-warning "leak" } */
 	  break;
 	case 3:
 	  free (p1); /* { dg-warning "double-'free' of 'p1'" } */
 	  break;
 
 	case 4:
-	  p2 = malloc (16);
+	  p2 = malloc (16); /* { dg-warning "leak" } */
 	  break;
 	case 5:
 	  free (p2); /* { dg-warning "double-'free' of 'p2'" } */
 	  break;
 
 	case 6:
-	  p3 = malloc (16);
+	  p3 = malloc (16); /* { dg-warning "leak" } */
 	  break;
 	case 7:
 	  free (p3); /* { dg-warning "double-'free' of 'p3'" } */
diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-8-double-free.c b/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-8-double-free.c
index f86e8ac72d7..cdf5ac18324 100644
--- a/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-8-double-free.c
+++ b/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-8-double-free.c
@@ -61,111 +61,133 @@ void test (int i)
     |      |                    |
     |      |                    (2) calling 'make_boxed_int' from 'test'
     |
-    +--> 'make_boxed_int': events 3-6
+    +--> 'make_boxed_int': events 3-4
            |
            |   NN | make_boxed_int (int i)
            |      | ^~~~~~~~~~~~~~
            |      | |
            |      | (3) entry to 'make_boxed_int'
-           |......
+           |   NN | {
+           |   NN |   boxed_int *result = (boxed_int *)wrapped_malloc (sizeof (boxed_int));
+           |      |                                    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+           |      |                                    |
+           |      |                                    (4) calling 'wrapped_malloc' from 'make_boxed_int'
+           |
+           +--> 'wrapped_malloc': events 5-6
+                  |
+                  |   NN | void *wrapped_malloc (size_t size)
+                  |      |       ^~~~~~~~~~~~~~
+                  |      |       |
+                  |      |       (5) entry to 'wrapped_malloc'
+                  |   NN | {
+                  |   NN |   return malloc (size);
+                  |      |          ~~~~~~~~~~~~~
+                  |      |          |
+                  |      |          (6) allocated here (state of '<unknown>': 'start' -> 'unchecked', NULL origin)
+                  |
+           <------+
+           |
+         'make_boxed_int': events 7-10
+           |
+           |   NN |   boxed_int *result = (boxed_int *)wrapped_malloc (sizeof (boxed_int));
+           |      |                                    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+           |      |                                    |
+           |      |                                    (7) returning to 'make_boxed_int' from 'wrapped_malloc'
            |   NN |   if (!result)
-           |      |      ~
+           |      |      ~                              
            |      |      |
-           |      |      (4) following 'false' branch (when 'result' is non-NULL)...
+           |      |      (8) assuming 'result' is non-NULL (state of 'result': 'unchecked' -> 'nonnull', NULL origin)
+           |      |      (9) following 'false' branch (when 'result' is non-NULL)...
            |   NN |     abort ();
            |   NN |   result->i = i;
-           |      |   ~~~~~~~~~~~~~
+           |      |   ~~~~~~~~~~~~~                     
            |      |             |
-           |      |             (5) ...to here
-           |   NN |   return result;
-           |      |          ~~~~~~
-           |      |          |
-           |      |          (6) state of '<return-value>': 'start' -> 'nonnull' (origin: NULL)
+           |      |             (10) ...to here
            |
     <------+
     |
-  'test': events 7-8
+  'test': events 11-12
     |
     |   NN |   boxed_int *obj = make_boxed_int (i);
     |      |                    ^~~~~~~~~~~~~~~~~~
     |      |                    |
-    |      |                    (7) returning to 'test' from 'make_boxed_int'
+    |      |                    (11) returning to 'test' from 'make_boxed_int'
     |   NN | 
     |   NN |   free_boxed_int (obj);
     |      |   ~~~~~~~~~~~~~~~~~~~~
     |      |   |
-    |      |   (8) calling 'free_boxed_int' from 'test'
+    |      |   (12) calling 'free_boxed_int' from 'test'
     |
-    +--> 'free_boxed_int': events 9-10
+    +--> 'free_boxed_int': events 13-14
            |
            |   NN | free_boxed_int (boxed_int *bi)
            |      | ^~~~~~~~~~~~~~
            |      | |
-           |      | (9) entry to 'free_boxed_int'
+           |      | (13) entry to 'free_boxed_int'
            |   NN | {
            |   NN |   wrapped_free (bi);
            |      |   ~~~~~~~~~~~~~~~~~
            |      |   |
-           |      |   (10) calling 'wrapped_free' from 'free_boxed_int'
+           |      |   (14) calling 'wrapped_free' from 'free_boxed_int'
            |
-           +--> 'wrapped_free': events 11-12
+           +--> 'wrapped_free': events 15-16
                   |
                   |   NN | void wrapped_free (void *ptr)
                   |      |      ^~~~~~~~~~~~
                   |      |      |
-                  |      |      (11) entry to 'wrapped_free'
+                  |      |      (15) entry to 'wrapped_free'
                   |   NN | {
                   |   NN |   free (ptr);
                   |      |   ~~~~~~~~~~
                   |      |   |
-                  |      |   (12) first 'free' here (state of 'ptr': 'nonnull' -> 'freed', origin: NULL)
+                  |      |   (16) first 'free' here (state of 'ptr': 'nonnull' -> 'freed', NULL origin)
                   |
            <------+
            |
-         'free_boxed_int': event 13
+         'free_boxed_int': event 17
            |
            |   NN |   wrapped_free (bi);
            |      |   ^~~~~~~~~~~~~~~~~
            |      |   |
-           |      |   (13) returning to 'free_boxed_int' from 'wrapped_free'
+           |      |   (17) returning to 'free_boxed_int' from 'wrapped_free'
            |
     <------+
     |
-  'test': events 14-15
+  'test': events 18-19
     |
     |   NN |   free_boxed_int (obj);
     |      |   ^~~~~~~~~~~~~~~~~~~~
     |      |   |
-    |      |   (14) returning to 'test' from 'free_boxed_int'
+    |      |   (18) returning to 'test' from 'free_boxed_int'
     |   NN | 
     |   NN |   free_boxed_int (obj);
     |      |   ~~~~~~~~~~~~~~~~~~~~
     |      |   |
-    |      |   (15) passing freed pointer 'obj' in call to 'free_boxed_int' from 'test'
+    |      |   (19) passing freed pointer 'obj' in call to 'free_boxed_int' from 'test'
     |
-    +--> 'free_boxed_int': events 16-17
+    +--> 'free_boxed_int': events 20-21
            |
            |   NN | free_boxed_int (boxed_int *bi)
            |      | ^~~~~~~~~~~~~~
            |      | |
-           |      | (16) entry to 'free_boxed_int'
+           |      | (20) entry to 'free_boxed_int'
            |   NN | {
            |   NN |   wrapped_free (bi);
            |      |   ~~~~~~~~~~~~~~~~~
            |      |   |
-           |      |   (17) passing freed pointer 'bi' in call to 'wrapped_free' from 'free_boxed_int'
+           |      |   (21) passing freed pointer 'bi' in call to 'wrapped_free' from 'free_boxed_int'
            |
-           +--> 'wrapped_free': events 18-19
+           +--> 'wrapped_free': events 22-23
                   |
                   |   NN | void wrapped_free (void *ptr)
                   |      |      ^~~~~~~~~~~~
                   |      |      |
-                  |      |      (18) entry to 'wrapped_free'
+                  |      |      (22) entry to 'wrapped_free'
                   |   NN | {
                   |   NN |   free (ptr);
                   |      |   ~~~~~~~~~~
                   |      |   |
-                  |      |   (19) second 'free' here; first 'free' was at (12) ('ptr' is in state 'freed')
+                  |      |   (23) second 'free' here; first 'free' was at (16) ('ptr' is in state 'freed')
                   |
    { dg-end-multiline-output "" } */
 
diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-8-unchecked.c b/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-8-unchecked.c
index a778a29852f..320044753a1 100644
--- a/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-8-unchecked.c
+++ b/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-8-unchecked.c
@@ -1,6 +1,6 @@
 /* Example of a multilevel wrapper around malloc, with an unchecked write.  */
 
-/* { dg-additional-options "-fdiagnostics-show-line-numbers -fdiagnostics-path-format=inline-events -fanalyzer-checker=malloc -fdiagnostics-show-caret -fanalyzer-verbose-state-changes" } */
+/* { dg-additional-options "-fdiagnostics-show-line-numbers -fdiagnostics-path-format=inline-events -fanalyzer-checker=malloc -fdiagnostics-show-caret" } */
 /* { dg-enable-nn-line-numbers "" } */
 
 #include <stdlib.h>
@@ -49,7 +49,7 @@ make_boxed_int (int i)
            |   NN |   return malloc (size);
            |      |          ~~~~~~~~~~~~~
            |      |          |
-           |      |          (4) this call could return NULL (state of '<return-value>': 'start' -> 'unchecked', origin: NULL)
+           |      |          (4) this call could return NULL
            |
     <------+
     |
@@ -62,6 +62,6 @@ make_boxed_int (int i)
     |   NN |   result->i = i;
     |      |   ~~~~~~~~~~~~~                     
     |      |             |
-    |      |             (6) 'result' could be NULL: unchecked value from (4) ('result' is in state 'unchecked')
+    |      |             (6) 'result' could be NULL: unchecked value from (4)
     |
   { dg-end-multiline-output "" } */
diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-paths-9.c b/gcc/testsuite/gcc.dg/analyzer/malloc-paths-9.c
index c5ff96e5644..a3cacc07fab 100644
--- a/gcc/testsuite/gcc.dg/analyzer/malloc-paths-9.c
+++ b/gcc/testsuite/gcc.dg/analyzer/malloc-paths-9.c
@@ -112,8 +112,7 @@ int test_3 (int x, int y)
     free (ptr); /* No double-'free' warning: we've already attempted
 		   to dereference it above.  */
   return *ptr; /* { dg-warning "use after 'free' of 'ptr'" "use-after-free" } */
-  // TODO: two warnings here:  one is from sm-malloc, the other from region model
-  /* { dg-warning "leak of 'ptr'" "leak" { target *-*-* } .-2 } */
+  /* { dg-warning "leak of 'ptr'" "leak" { target *-*-* } .-1 } */
 }
 
 /* "dereference of possibly-NULL 'ptr'".  */
@@ -241,59 +240,3 @@ int test_3 (int x, int y)
     |      |          (7) 'ptr' leaks here; was allocated at (1)
     |
    { dg-end-multiline-output "" } */
-
-/* "use after 'free' of 'ptr'".  */
-/* { dg-begin-multiline-output "" }
-   NN |   *ptr = 19;
-      |   ~~~~~^~~~
-  'test_3': events 1-3
-    |
-    |   NN |   if (x)
-    |      |      ^
-    |      |      |
-    |      |      (1) following 'true' branch (when 'x != 0')...
-    |   NN |     free (ptr);
-    |      |     ~~~~~~~~~~
-    |      |     |
-    |      |     (2) ...to here
-    |   NN | 
-    |   NN |   *ptr = 19;
-    |      |   ~~~~~~~~~
-    |      |        |
-    |      |        (3) use after 'free' of 'ptr' here
-    |
-   { dg-end-multiline-output "" } */
-
-/* "use after 'free' of 'ptr'".  */
-/* { dg-begin-multiline-output "" }
-   NN |   return *ptr;
-      |          ^~~~
-  'test_3': events 1-5
-    |
-    |   NN |   if (x)
-    |      |      ^
-    |      |      |
-    |      |      (1) following 'false' branch (when 'x == 0')...
-    |......
-    |   NN |   *ptr = 19;
-    |      |   ~~~~~~~~~
-    |      |        |
-    |      |        (2) ...to here
-    |......
-    |   NN |   if (y)
-    |      |      ~
-    |      |      |
-    |      |      (3) following 'true' branch (when 'y != 0')...
-    |   NN |     free (ptr);
-    |      |     ~~~~~~~~~~
-    |      |     |
-    |      |     (4) ...to here
-    |   NN |      to dereference it above
-    |   NN |   return *ptr;
-    |      |          ~~~~
-    |      |          |
-    |      |          (5) use after 'free' of 'ptr' here
-    |
-   { dg-end-multiline-output "" } */
-/* TODO: this is really a duplicate; can we either eliminate it, or
-   improve the path?  */
-- 
2.26.2

